Calderbrook Housing Group - Data Processing Agreement (signed)
Documentexecuted Calderbrook Housing Group: documents · dpa · executed · 2024-08-16
Executed Data Processing Agreement under the MSA, signed 16 Aug 2024. Calderbrook is controller and BB-Demo processor, with data kept in the customer's own Snowflake account. It states no availability, response time or price.
What it says
What this says
Current to 11 Oct 26Executed Data Processing Agreement under the MSA, signed 16 Aug 2024. Calderbrook is controller and BB-Demo processor, with data kept in the customer's own Snowflake account. It states no availability, response time or price.
What it is: an executed DPA that forms part of the Master Services Agreement. It says BB-Demo "will process the Controller data only on the Controller's documented instructions" and sets the purpose as a combined picture of tenant calls, repairs tickets, complaints and rent arrears.
Commits: BB-Demo to confidentiality, role-based access, help with data subject requests, prompt breach notification "without undue delay", audits on reasonable notice, and removal of access and deletion of outside copies at the end.
Unusual: general authorisation for sub-processors, with notice and a fair opportunity to object. Transfers outside the United Kingdom need a lawful mechanism and notice to the Controller.
Not settled: no price, service levels, renewal date or term. The Controller signatory is only named as an authorised signatory, so the evidence does not show who signed for Calderbrook.
As found in this document
Current to 9 Oct 26- Date signed16 Aug 2024Source: object_read:doc_007_006
- Processing instructionsBB-Demo will process the Controller data only on the Controller's documented instructionsBB-Demo will process the Controller data only on the Controller's documented instructions · Source: object_read:doc_007_006
- Data locationBB-Demo will not move Controller data out of that account except as the Controller instructs in writing.BB-Demo will not move Controller data out of that account except as the Controller instructs in writing. · Source: object_read:doc_007_006
- Personal data breachit will tell the Controller without undue delayit will tell the Controller without undue delay · Source: object_read:doc_007_006
- International transfersBB-Demo will not transfer Controller data outside the United Kingdom unless the transfer is covered by a lawful transfer mechanism and the Controller has been told.BB-Demo will not transfer Controller data outside the United Kingdom unless the transfer is covered by a lawful transfer mechanism and the Controller has been told. · Source: object_read:doc_007_006
- Auditon reasonable notice, during business hours and without unreasonable disruptionon reasonable notice, during business hours and without unreasonable disruption · Source: object_read:doc_007_006
- Return and deletionBB-Demo will remove its access and delete any copies it holds outside that account, unless the law requires them to be kept.BB-Demo will remove its access and delete any copies it holds outside that account, unless the law requires them to be kept. · Source: object_read:doc_007_006
The document
Body
Calderbrook Housing Group - Data Processing Agreement (signed)
Status: Executed. Signed on 16 Aug 2024.
This Data Processing Agreement forms part of the Master Services Agreement between Calderbrook Housing Group (the Controller) and BB-Demo (the Processor). It sets out how BB-Demo handles personal data on the Controller's behalf.
Definitions
- Data protection law means the UK GDPR and the other data protection legislation that applies to the processing under this agreement.
- Personal data, processing, controller, processor, data subject and personal data breach have the meanings given in data protection law.
- Controller data means the personal data that the Controller connects to, or asks BB-Demo to process within, the company brain.
- Services means the services described in the Master Services Agreement.
Roles of the parties
The Controller is the controller of the Controller data. BB-Demo is the processor. BB-Demo will process the Controller data only on the Controller's documented instructions, which are the Master Services Agreement, this agreement and any further written instruction the Controller gives.
Read the whole document (5,592 characters)
Subject matter and nature of processing
| Item | Description |
|---|---|
| Subject matter | Provision of the company brain to the Controller |
| Purpose | To index, search and answer questions over the Controller's connected data so its business-intelligence team can build a combined picture of tenant calls, repairs tickets, complaints and rent arrears |
| Nature | Storage, indexing, retrieval, analysis and display within the Controller's own Snowflake account |
| Duration | The term of the Master Services Agreement, and any period needed to return or delete the data after it ends |
| Data subjects | The Controller's tenants, applicants, staff, contractors and other individuals who appear in connected records |
| Types of data | Contact details, account and tenancy references, call recordings and transcripts, ticket and complaint content, arrears records and similar operational data |
Location of the data
The company brain is built and run inside the Controller's own Snowflake account. The Controller therefore keeps the data in the environment it already controls. BB-Demo will not move Controller data out of that account except as the Controller instructs in writing.
Processor obligations
BB-Demo will:
- process the Controller data only for the purposes of providing the Services;
- make sure that everyone who has access to the Controller data is bound by a duty of confidentiality;
- apply appropriate technical and organisational measures to protect the Controller data, as described in the security section below;
- help the Controller to respond to requests from data subjects who exercise their rights;
- help the Controller with its security, breach notification and impact assessment duties, taking into account the nature of the processing;
- tell the Controller promptly if it believes an instruction would breach data protection law.
Security
BB-Demo maintains access controls based on role, uses the Controller's own Snowflake access model, keeps access to Controller data to named staff who need it, and records administrative access. The Controller is responsible for the access it grants to its own users and for the security of the systems it connects.
Sub-processors
The Controller gives general authorisation for BB-Demo to use sub-processors needed to provide the Services. BB-Demo will keep a current list available to the Controller, will tell the Controller before adding or replacing a sub-processor, and will give the Controller a fair opportunity to object. BB-Demo remains responsible for its sub-processors and will bind them to obligations no less protective than those in this agreement.
Personal data breaches
If BB-Demo becomes aware of a personal data breach affecting the Controller data, it will tell the Controller without undue delay and give the information the Controller reasonably needs to meet its own duties. BB-Demo will take reasonable steps to contain the breach and put it right.
International transfers
BB-Demo will not transfer Controller data outside the United Kingdom unless the transfer is covered by a lawful transfer mechanism and the Controller has been told. Any data residency requirement agreed in an order form takes precedence.
Audit
BB-Demo will make available the information reasonably needed to show compliance with this agreement and will allow audits by the Controller or its appointed auditor, on reasonable notice, during business hours and without unreasonable disruption.
Return and deletion
On ending the Master Services Agreement, BB-Demo will stop processing the Controller data. Because the data stays in the Controller's own Snowflake account, BB-Demo will remove its access and delete any copies it holds outside that account, unless the law requires them to be kept.
Liability and order of precedence
Liability under this agreement is subject to the limits in the Master Services Agreement. If this agreement conflicts with the Master Services Agreement on the handling of personal data, this agreement prevails.
Governing law
This agreement is governed by the law of England and Wales.
Signatures
| For BB-Demo (Processor) | For Calderbrook Housing Group (Controller) | |
|---|---|---|
| Name | Tom Ashdown | Authorised signatory |
| Title | Account Executive | Authorised signatory, Calderbrook Housing Group |
| Date | 16 Aug 2024 | 16 Aug 2024 |
Unusual terms
Current to 9 Oct 26- General authorisation for sub-processors
- DPA prevails over MSA on personal data
- Order form data residency takes precedence